All Posts by Admin

We just received a good email report from a user (thanks Dalevi1) that had some page source.  We did notice one common ad in the two pages and have disabled it.

I will be very anxious to know if this still happens to anyone (due to page caching it might take a couple hours to really know)

We just received a good email report from a user (thanks Dalevi1) that had some page source.  We did notice one common ad in the two pages and have disabled it.

I will be very anxious to know if this still happens to anyone (due to page caching it might take a couple hours to really know)

Hello,

We have been trying to locate the source of this for some time now and are not having any luck.  The oddness in this is that not very many people are seeing this (including all of our staff).  We are leaning towards the theory that the user might already need to have something on their computer, perhaps a spyware/malware app that reacts to a keyword on our site or something.

We are actively monitoring this situation and trying to determine where it is originating from and eliminate it if indeed it originates from our site or one of our advertisers.

Any information you can post from your security programs will help greatly.  For example - Trend Micro will tell you the exact file in your temporary browser cache that tried to launch the pop up.  The name of this file would help us GREATLY.

What we really need is a screen of our webpage when it popped up.  Looking at your taskbar our page is still there - just minimized.  I think these steps would help:

1) After pop up, click F4 to force close that window (if you click anything on that pop up it will re-direct our page to the trojan installer)

2) Click back on our site on the taskbar

3) Take a screen shot (more multiples if the page is longer than one screen) - we really need to see all the ads

4) Right click on the page and select "View Source" - save this as a txt file and email to admin@mmorpg.com

Thanks!

Originally posted by dalevi1

Originally posted by Admin

We are really stumped on this one.  None of us are getting this pop up and I installed Trend Micro Security 2008 and it also has not sniffed anything out.   We shut off our ads for a couple hours and we still had a couple reports - we turned them on a couple hours ago and have still had just a couple (compared to dozens this monring when we first heard about it).

It is definately not affecting most users - only a select few.  Normally if something like this is happening to the majority we get masses of emails/posts per hour, and we are really seeing a small amount of comments on this now.

Because we cannot recreate the pop up it is nearly impossible to troubleshoot...especially because the users that do seem to get it only see it once in a rare while - so it is not like we can test different things

Could this possibly be culled from a user importing a graphic/script from a 3rd party site?

I don't think so because it is happening on many pages of the site (that is what we have heard anyways) - so far we have heard the forums, blogs and game list pages.

We are really stumped on this one.  None of us are getting this pop up and I installed Trend Micro Security 2008 and it also has not sniffed anything out.   We shut off our ads for a couple hours and we still had a couple reports - we turned them on a couple hours ago and have still had just a couple (compared to dozens this monring when we first heard about it).

It is definately not affecting most users - only a select few.  Normally if something like this is happening to the majority we get masses of emails/posts per hour, and we are really seeing a small amount of comments on this now.

Because we cannot recreate the pop up it is nearly impossible to troubleshoot...especially because the users that do seem to get it only see it once in a rare while - so it is not like we can test different things

Ok, we have shut off all ads served from sources outside our network.  The only ads running are being delivered from MMORPG.com (we also kept the DoubleClick hosted ads since I am 99.9% sure they are not the source being they serve over half of the ads on the Internet)

Please report as much detail of any new findings!

Obvioiusly this is not something we would endorse.  However we do run some ad networks that serve ads into our site.  I am also confident that our ad providers did not willingly do this but it could be possible that they are compromised or something.

The problem we are having fighting this right now is we cannot reproduce it on our end.  We have checked all of our web servers and what we do know is that we were not "hacked" and pages were not altered. This leaves the following options:

1) The ad networks are sending in the pop up/  / malware

2) Users already have a spyware app on their system that is reacting to keywords/ads or something on our site.

We are probably going to shutoff the external ads fora  few hours and see if the reports stop coming into this thread...since we don't see it here this is our only option right now

We will try to find out what is causing this.  I am not getting this but if people could post the following:

1) Your browser

2) Any ads that are on the page when you see this

3) The software giving you the warning (your spyware/virus scanner, etc)

4) The exact warning message

This could never happen on our internal ads since we place the SWF or GIF/JPG directly on the page ourselves - but we do use 2 seperate outside netowrks.  While I would hope they would not do such a thing - if it is coming from an ad (which it may not be) it would be from one of these and we would need to shut it off and report it.

Hello,

We lost our login history table this morning in our database.  We are working on having this restored from a backup file and should have things back to normal before the contest drawing.

Thanks for your patience.

Hello,

We lost our login history table this morning in our database.  We are working on having this restored from a backup file and should have things back to normal before the contest drawing.

Thanks for your patience.